eMudhra CA cleanup spreads across three more betas

The eMudhra CA distrust cycle keeps surfacing days after it first appeared: ntfy, Paperless-ngx, and openclaw all ship this cycle rejecting or replacing the compromised intermediate, spanning monitoring, document management, and AI tooling. Three releases carry explicit security flags, Bisq's Tor update, Uptime Kuma's cert and SSL fixes, DAVx5's account-creation exception handling, but the broader 46-item day is dominated by dependency and toolchain bumps rather than new capability. AI remains the largest single beat at 13 items, still no model releases, mostly SDK, CLI, and runtime patches. Bitcoin and Self-hosting trail at 10 each, Privacy at 9. Read today as continued infrastructure hardening against last week's CA incident, not a day of feature shipping.

Bitcoin#

Bisq 1.10.10. Updated the netlayer dependency to v0.7.12, which includes Tor 0.4.9.14; Renewed the validity of the release signing keys and removed the unused, expired key 4A133008.
Alby Hub 1.24.4. Return the settled payment from transaction lookup on Postgres; Use our own LND channel policy when updating routing fees.
Keystone 3 3.2.0. Details All 3 Versions: Improved UI performance Firmware
KeyOS 1.4.1. Passport Prime now shows a full-screen alert when the battery reaches 2% or lower, warning that it will shut down automatically.
Mempool 3.3.2. Upgrades Node.js from v24.13.0 to v26.12.1.
Ledger Live Mobile 4.25.0. 23341 a86963c Thanks @LucasWerey!
Ledger Live Desktop 4.25.0. 23341 a86963c Thanks @LucasWerey!
Fedimint Web React Native SDK 0.1.0-beta.2. React Native SDK 0.1.0-beta.2 Added - useBalance(federation) and useOperation(operation), React hooks that keep a component up to date with a federation's balance and an operation's state.
Fedimint Web Rust SDK 0.1.0-beta.2. Rust SDK 0.1.0-beta.2 No change to the API; Changed - docs.rs no longer compiles RocksDB to document the crate.
Lightning Loop 0.35.2-beta. Update github.com/klauspost/compress to v1.18.7 in the root and looprpc modules, including the fix for an out-of-bounds read in s2.NewDict.

Nostr#

cln-nip47 0.2.2. Updated dependencies in response to 7 RUSTSEC security advisories: RUSTSEC-2026-0365, RUSTSEC-2026-0346, RUSTSEC-2026-0349, RUSTSEC-2026-0347, RUSTSEC-2026-0348, RUSTSEC-2026-0382, and RUSTSEC-2026-0381.
Mostro 0.20.1. Rebind an exported reputation; Handle export-reputation.

Privacy#

Dangerzone 0.11.1. Users can now choose to disable or skip update checks; GitHub release notes are no longer rendered from Markdown to HTML in the application.
Invidious 2.20261022.0. Video IDs are now sanity-checked with a regex, rejecting malformed IDs earlier; Updated translations from Hosted Weblate.
Bitwarden Clients Desktop 2026.10.1. Maintenance bump version to 10.0.1 for chocolatey release
Yattee 2.0.0-beta.275. Subscriptions, feed, playlists and watch history now follow the selected account, and accounts can be set inactive without signing out.
Notesnook Desktop 3.4.10. Read about what's new in Notesnook Desktop v3.4.10 on Notesnook's blog
Delta Chat iOS 2.64.0. Pinned Messages; Nicer profile and group image selection.
Signal Android 8.33.1. A new and improved keyboard for emojis, stickers, and animated GIFs is our GIFt to you; For automatic updates, we recommend using Obtainium.
dnscrypt-proxy 2.1.20. Name lists now support regex: rules for matching domain names with regular expressions.
NetNewsWire 7.3b2 for Mac. Fixed a crash at midnight when the status bar is showing; Added the last-refresh time to the status bar, and made it the default.

Self-hosting#

Uptime Kuma 2.5.7. Bug Fixes - 7989 retries ignored by TCP Port monitor with SSL/STARTTLS Security Fixes - Docker Images bumped to Node.js 22.23.4, now it rejects the leaked eMudhra 384 bit CA...
DAVx5 4.5.22-beta.1-ose. Handle account creation security exceptions; Bump the app-dependencies group with 6 updates.
Portainer 2.45.3. On Async Edge environments, an invalid update schedule date can be displayed when browsing a snapshot; Podman environments aren't supported by auto-onboarding script.
ntfy 2.33.1. Show each cluster node's view of its peers with ntfy cluster status, /v1/cluster/status on the cluster listener, and per-peer metrics, so a link that only works in one direction is visible (experimental clustering…
Paperless-ngx 3.3.4. Paperless-ngx 3.3.4 !NOTE This security maintenance release updates dependencies to address the eMudhra / emSign CA certificate security incident and security vulnerabilities in Pillow and aiohttp.
Nextcloud iOS Version 35.2.1. Unify navigation overflow and organize file action menus This release also includes all changes from 35.2.0 (
StartOS start-cli 2.5.0. The identity key can live in gpg-agent.
StartOS 0.4.0. DNS queries follow your chosen outbound gateway.
Jellyfin 12.3. Suppresses useless warnings PR 18337; Do not store ratings or gains that are not finite numbers PR 18267.
Stirling-PDF 3.2.1. Arrow key support for viewer; Dual page view to support cover pages.

AI#

openclaw 2026.10.6. This patch release contains focused reliability fixes only; it does not introduce new user-facing features.
NanoClaw 2026.10.1-rc.2. Agents can create other agents from templates.
Qwen Code 0.26.0-nightly.20261022.bf66a26c97. Add daemon token persistence; Cover every spawned vendored binary in the tarball exec-bit gate.
Hermes Agent 0.22.5. Microsoft Store app: updates through the Store; Desktop app installed from the installer (.exe /.dmg): no change in this release; it updates with the next bundled release.
LocalAI 4.12.0. Redesigned web UI: shared controls, light and dark themes, clearer Models and Studio workflows, and node-scoped backend maintenance.
opencode 1.19.4. Core Improvements - Upgraded the bundled Bun runtime to 1.4.4, which includes security fixes for Brotli, TLS, HTTP/1.1, HTTP/2, HTTP/3, WebSocket, and fetch, and updates root certificates to NSS 3.131.1.
Dify 1.18.0. Back up first.
langchain-core== 1.7.0. If you read raw stream events and their block-delta args mid-stream, read tool-call-delta instead..tool calls.get() and.output are unchanged.
llama.cpp b11829. MacOS Apple Silicon (arm64); MacOS Apple Silicon (arm64, KleidiAI enabled) DISABLED.
OpenAgentCore 0.0.13-rc.2. Core for Linux, macOS and Windows; Linux amd64 Node distribution from commit 01a041c.
Claude Agent Sdk Python 0.2.173. Internal/Other Changes Updated bundled Claude CLI to version 2.1.309 PyPI: pip install claude-agent-sdk==0.2.173
Cli 1.7.1. Install elevenlabs-cli 1.7.1 Install prebuilt binaries via shell script curl --proto ' =https ' --tlsv1.2 -LsSf | sh Install prebuilt binaries via powershell script powershell...
Packages Convai Widget Core 0.21.3. E657aea: Show animated typing dots in text chat while the agent works on its reply.

Other#

Canadians Are Running Out Of Time To Oppose The Dangerous C-22 Surveillance Bill. Canada's Parliament is debating a massive expansion of surveillance powers that will threaten the privacy and security of millions of people.

Read on Freedom.Tech: https://freedom.tech/posts/2026-10-23-bitcoin-daily-brief/ Get the weekly recap in your inbox: https://freedom.tech/subscribe/

Freedom.Tech is powered by Foundation. Catch the weekly discussion on Freedom Tech Friday via Ungovernable Misfits.